CVE-2026-98284

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netlink: do not free nlk->groups while lockless readers can use it

netlink_realloc_groups() uses krealloc() under netlink_table_grab().

Whenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old

bitmap is freed immediately.

Two readers of nlk->groups / nlk->ngroups do not hold the netlink

table lock:

1) sk_diag_dump_groups(). Hashed (bound) sockets are dumped from the

rhashtable walk in __netlink_diag_dump(), which only holds RCU.

Only the mc_list part of the dump takes nl_table_lock.

2) netlink_native_seq_show() (/proc/net/netlink), whose walk has been

lockless since commit 21e4902aea80 ("netlink: Lockless lookup with

RCU grace period in socket release").

Both can read a freed buffer, and sk_diag_dump_groups() can also read

past the end of the old (smaller) buffer if it happens to load the old

@groups pointer together with the new @ngroups value, copying the

result into a NETLINK_DIAG_GROU

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References